IM
IronMonkey Threat Research

CVE-2022-1292 CRITICAL

Published: 2022-05-03 | Last Modified: 2025-08-13 | Status: Modified

Description

The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd).

Additional Descriptions (1)

El script c_rehash no sanea apropiadamente los meta caracteres del shell para evitar la inyección de comandos. Este script es distribuido por algunos sistemas operativos de manera que es ejecutado automáticamente. En dichos sistemas operativos, un atacante podría ejecutar comandos arbitrarios con los privilegios del script. El uso del script c_rehash es considerado obsoleto y debe ser sustituido por la herramienta de línea de comandos OpenSSL rehash. Corregido en OpenSSL versión 3.0.3 (Afectado 3.0.0,3.0.1,3.0.2). Corregido en OpenSSL versión 1.1.1o (Afectado 1.1.1-1.1.1n). Corregido en OpenSSL versión 1.0.2ze (Afectado 1.0.2-1.0.2zd)

CVSS Metrics

Base Score: 7.3 (HIGH)

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack VectorLOCAL
Attack ComplexityLOW
Privileges RequiredLOW
User InteractionREQUIRED
ScopeUNCHANGED
Confidentiality ImpactHIGH
Integrity ImpactHIGH
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 1.3

Impact Score: 5.9

Base Score: 10.0 (HIGH)

AV:N/AC:L/Au:N/C:C/I:C/A:C

Access VectorNETWORK
Access ComplexityLOW
AuthenticationNONE
Confidentiality ImpactCOMPLETE
Integrity ImpactCOMPLETE
Availability ImpactCOMPLETE

Source: [email protected]

Type: Primary

Exploitability Score: 10.0

Impact Score: 10.0

Weaknesses

Source Type Description
[email protected] Primary
en CWE-78
134c704f-9b21-4f2e-91b3-4a467353bcc0 Secondary
en CWE-78

Affected Products

Vendor Product Version Update Type
siemens brownfield_connectivity_gateway * <built-in method update of dict object at 0x7fd384120900> Application
openssl openssl * <built-in method update of dict object at 0x7fd369ace500> Application
openssl openssl * <built-in method update of dict object at 0x7fd341269380> Application
openssl openssl * <built-in method update of dict object at 0x7fd3856923c0> Application
debian debian_linux 9.0 <built-in method update of dict object at 0x7fd384121300> Operating System
debian debian_linux 10.0 <built-in method update of dict object at 0x7fd384120d00> Operating System
debian debian_linux 11.0 <built-in method update of dict object at 0x7fd342022a00> Operating System
netapp active_iq_unified_manager - <built-in method update of dict object at 0x7fd36a2dcd80> Application
netapp active_iq_unified_manager - <built-in method update of dict object at 0x7fd342023940> Application
netapp active_iq_unified_manager - <built-in method update of dict object at 0x7fd384122ac0> Application
netapp clustered_data_ontap - <built-in method update of dict object at 0x7fd386738340> Application
netapp clustered_data_ontap_antivirus_connector - <built-in method update of dict object at 0x7fd384e83500> Application
netapp oncommand_insight - <built-in method update of dict object at 0x7fd384e81740> Application
netapp oncommand_workflow_automation - <built-in method update of dict object at 0x7fd342023c40> Application
netapp santricity_smi-s_provider - <built-in method update of dict object at 0x7fd384e807c0> Application
netapp smi-s_provider - <built-in method update of dict object at 0x7fd3686cb9c0> Application
netapp snapcenter - <built-in method update of dict object at 0x7fd39c4e0340> Application
netapp snapmanager - <built-in method update of dict object at 0x7fd39c4eb700> Application
netapp solidfire\,_enterprise_sds_\&_hci_storage_node - <built-in method update of dict object at 0x7fd34126b1c0> Application
netapp solidfire_\&_hci_management_node - <built-in method update of dict object at 0x7fd2dbed2240> Application
netapp a700s_firmware - <built-in method update of dict object at 0x7fd36a0d6fc0> Operating System
netapp h300s_firmware - <built-in method update of dict object at 0x7fd369acdf40> Operating System
netapp h500s_firmware - <built-in method update of dict object at 0x7fd36b57e300> Operating System
netapp h700s_firmware - <built-in method update of dict object at 0x7fd384e82940> Operating System
netapp h300e_firmware - <built-in method update of dict object at 0x7fd36941a3c0> Operating System
netapp h500e_firmware - <built-in method update of dict object at 0x7fd36978af80> Operating System
netapp h700e_firmware - <built-in method update of dict object at 0x7fd36941a740> Operating System
netapp h410s_firmware - <built-in method update of dict object at 0x7fd342022b40> Operating System
netapp aff_8300_firmware - <built-in method update of dict object at 0x7fd386794680> Operating System
netapp fas_8300_firmware - <built-in method update of dict object at 0x7fd342020e00> Operating System
netapp aff_8700_firmware - <built-in method update of dict object at 0x7fd39c4e9940> Operating System
netapp fas_8700_firmware - <built-in method update of dict object at 0x7fd34126a140> Operating System
netapp aff_a400_firmware - <built-in method update of dict object at 0x7fd289d31680> Operating System
netapp fabric-attached_storage_a400_firmware - <built-in method update of dict object at 0x7fd39c4e2240> Operating System
netapp a250_firmware - <built-in method update of dict object at 0x7fd36befa980> Operating System
netapp aff_500f_firmware - <built-in method update of dict object at 0x7fd34b829000> Operating System
netapp fas_500f_firmware - <built-in method update of dict object at 0x7fd369acdb40> Operating System
oracle enterprise_manager_ops_center 12.4.0.0 <built-in method update of dict object at 0x7fd36befa100> Application
oracle mysql_server * <built-in method update of dict object at 0x7fd3429bda80> Application
oracle mysql_server * <built-in method update of dict object at 0x7fd369acda40> Application
oracle mysql_workbench * <built-in method update of dict object at 0x7fd369acd800> Application
fedoraproject fedora 35 <built-in method update of dict object at 0x7fd369acc740> Operating System
fedoraproject fedora 36 <built-in method update of dict object at 0x7fd369ace440> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:siemens:brownfield_connectivity_gateway:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
Yes cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:*
Yes cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
Yes cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:santricity_smi-s_provider:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:smi-s_provider:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:hyper-v:*:*
Yes cpe:2.3:a:netapp:solidfire\,_enterprise_sds_\&_hci_storage_node:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:a700s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:a700s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:aff_8300_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:aff_8300:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:fas_8300_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:fas_8300:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:aff_8700_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:aff_8700:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:fas_8700_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:fas_8700:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:aff_a400_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:aff_a400:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:fabric-attached_storage_a400_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:fabric-attached_storage_a400:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:a250_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:a250:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:aff_500f_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:aff_500f:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:fas_500f_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:fas_500f:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
Yes cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*

References